Add New Relic MCP connector for on-call triage - #221
Open
maralski wants to merge 3 commits into
Open
Conversation
New Relic's hosted MCP server (docs.newrelic.com/docs/agentic-ai/mcp) exposes entities, alerts, NRQL, and incident-response tools that are a natural fit for the Ops persona's on-call triage workflow. Its recommended OAuth needs a vendor-registered redirect our DCR-only local OAuth flow can't provide (the same wall Asana hit), so this wires it up via the documented API-key method instead: - New ConnectorDescriptor (US/EU/JP region field, API key auth, no one-click OAuth) pinned to 11 triage-relevant tools (discovery, data-access, alerting, incident-response tags) via a new ConnectorDescriptor.mcp_auth field that decouples the MCP connect's auth from the manual field form's auth (jira's manual auth is "api_token" but its MCP path is still full OAuth — mcp_auth is what actually governs the one-click gate, in the descriptor and the GUI). - Manual API-key connect seeds a header-based MCP server entry itself (auth: "connector"); mcp/client.py injects the key fresh from the SecretStore at connect time so it never lands in the plain-text, paste-shareable mcp.json. Disconnect tears the seeded entry back down. - Ops persona now recommends the newrelic connector (core tier); demoted the still-unimplemented datadog placeholder to optional alongside it. Verified end-to-end against a live New Relic account: API-key validation, config seeding, and the real MCP handshake (all 11 pinned tool names matched the vendor's actual catalog). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Expand the newrelic connector's pin from 11 to all 27 tools New Relic's MCP server exposes. Drop the include-tags header entirely rather than list every documented tag: live-verified that convert_time_period_to_epoch_ms exists but carries none of the 6 documented tags, so any tag filter silently drops it — the pin (include_tools) is now the only allowlist that matters, and it's confirmed to match the vendor's real catalog exactly (27 == 27, live-tested). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Without a registry entry the connector fell back to the ◔ glyph — the same icon PagerDuty carries in its descriptor. PagerDuty renders its bundled siPagerduty mark so there was no visual collision, but New Relic looked unfinished. simple-icons already ships siNewrelic; wire it up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
maralski
marked this pull request as ready for review
July 27, 2026 03:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ConnectorDescriptor.mcp_authto decouple "how does the MCP one-click connect authenticate" fromauth(the manual field form's auth type) — needed because jira'sauthis"api_token"but its MCP path is still full OAuth (Atlassian supports DCR). The GUI's one-click button now gates onmcp_auth === "oauth"instead of assuming everymcp_urlconnector is OAuth-capable.auth: "connector");mcp/client.pyfetches the key fresh from the SecretStore at connect time so it's never written into the plain-text, paste-shareablemcp.json. Disconnect tears the seeded entry back down (no dangling config, mirroring the existing OAuth-backed teardown invariant).personas/builtin/ops.md) now recommends thenewrelicconnector atcoretier; demoted the still-unimplementeddatadogplaceholder tooptionalalongside it.Test plan
pytest tests/ -q— 892 passed, 1 skipped (added regression tests: seeded-config shape/region/teardown,mcp_authindependence fromauth, one-click fail-closed for non-oauth descriptors, dynamic header injection inmcp/client.py)npx tsc --noEmitinsurfaces/gui— cleannpx vitest runinsurfaces/gui— 68 passednpx playwright test(full e2e suite) — 153 passed, 1 pre-existing flaky test unrelated to this change (nav-collapse.spec.ts's ⌘B toggle, confirmed pre-existing/flaky via retry)mcp.json), and a real MCP handshake againstmcp.newrelic.com— all 11 pinned tool names matched the vendor's actual tool catalog (18 tools returned after theinclude-tagsfilter)🤖 Generated with Claude Code